zkat / pacote / 365

82%

push

travis-ci

feat(integrity): replace http client (#72)

Fixes: #75
Fixes: #56
Fixes: #47
Fixes: #41
Fixes: #3

This PR changes pacote over from using npm-registry-client for
its http stuff with a whole layer slapped on top to using
make-fetch-happen. There's some features that are now missing,
but those can be filled in before release.

New features:

* Faster, more robust http client.

* Subresource Integrity support for tarball shasums. `corgi.dist.integrity` will be respected

* `npm-notice` warnings

* `opts.refreshCache` will force a conditional request to make sure the cache is up to date.

BREAKING CHANGE: This PR replaces a pretty fundamental chunk of pacote.

* Caching now follows standard-ish cache rules for http-related requests.

* manifest() no longer includes the `_shasum` field. It's been replaced by `_integrity`, which is a Subresource Integrity hash string containing equivalent data. These strings can be parsed and managed using https://npm.im/ssri.

* Any functions that accepted `opts.digest` and/or `opts.hashAlgorithm` now expect `opts.integrity` instead.

* Packuments and finalized manifests are now cached using sha512. Tarballs can start using that hash (or any other more secure hash) once registries start supporting them: `packument.dist.integrity` will be prioritized over `packument.shasum`.

* If opts.offline is used, a `ENOCACHE` error will be returned.

265 of 378 branches covered (70.11%)

453 of 666 relevant lines covered (68.02%)

42.93 hits per line